Integer Overflow Vulnerability in Redis
Summary
CVE-2021-32625: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. Affects redis across 3 version ranges.
< 6.0.14-r0
< 941d58d4c916a8a273936fc168f62dad181f9705
< f9470c9a1765e407f5e50348e05d76d4b3a7aa2f
Fixed in 6.0.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an open source (BSD licensed) in-memory data structure store that serves as a database, cache, and message broker. It is widely used for its high performance and versatility. However, a vulnerability has been discovered in Redis versions 6.0 or newer that allows for potential remote code execution due to an integer overflow bug. This vulnerability is a result of an incomplete fix for a previous issue (CVE-2021-29477). The problem has been addressed in Redis versions 6.2.4 and 6.0.14.
Vulnerability Detail
The vulnerability can be exploited using the STRALGO LCS command, which triggers an integer overflow and corrupts the heap. This can potentially lead to remote code execution. The issue arises from the incomplete fix for CVE-2021-29477. To mitigate the problem without patching the redis-server executable, users can use ACL configuration to prevent clients from using the STRALGO LCS command. On 64-bit systems with the fixes from CVE-2021-29477 (6.2.3 or 6.0.13), ensuring that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB) is sufficient.
How To Fix
Minimum fixed version
6.0.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
An alternative workaround to mitigate the vulnerability is to use ACL configuration to restrict clients from using the STRALGO LCS command. By denying access to this command, the risk of exploitation can be reduced. However, it is still recommended to apply the official patches by updating Redis to the fixed versions.
Conclusion
The integer overflow vulnerability in Redis can lead to potential remote code execution. It is crucial to update Redis to version 6.2.4 or 6.0.14, which contain the necessary fixes. Additionally, using ACL configuration to restrict access to the STRALGO LCS command can provide an additional layer of protection. Regularly updating Redis and staying informed about security vulnerabilities is essential for maintaining a secure environment.
See every vulnerability recorded for redis →
FAQ
Redis is an open source in-memory data structure store that serves as a database, cache, and message broker. It is known for its high performance and versatility.
The vulnerability allows for potential remote code execution, which can lead to unauthorized access and control of the affected Redis instance. This can result in data breaches, system compromise, and other malicious activities.
Redis versions 6.0 or newer are affected by this vulnerability. Specifically, versions prior to 6.0.14 and 6.2.4 are vulnerable.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Redis installation is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the tool will analyze it for vulnerabilities in real-time.
Yes, you can use ACL configuration to prevent clients from using the STRALGO LCS command, which reduces the risk of exploitation. However, it is still recommended to apply the official patches by updating Redis to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
